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1. Introduction 

Simultaneous distance-independent correlation between different systems called entanglement [lj is the most char- 
acteristic trait that sharply distinguishes between quantum and classical worlds. At present entanglement between 
. two systems, i.e. bipartite entanglement, is quite well understood, but that between more than two systems, i.e. 
multipartite entanglement, remains still far from being satisfactorily known. In spite of that, multipartite entangle- 
ment has proven to play a superior role in recently emerging fields of quantum information processing and quantum 
computing since it exhibits a much richer structure than bipartite entanglement. Motivation for studying multipartite 
entanglement arises from many reasons some of which are listed now. First, multipartite entanglement provides a 
unique means to check the Einstein locality without invoking statistical arguments Q , contrary to the case of Bell 
inequalities using bipartite entanglement. Second, multipartite entanglement serves as a key ingredient for quantum 
computing to achieve an exponential speedup over classical computation Third, multipartite entanglement is 
central to quantum error correction where it is used to encode states, to detect errors and, eventually, to allow 
CNj , fault-tolerant quantum computation jjj, Fourth, multipartite entanglement helps to better characterize the critical 
behavior of different many-body quantum systems giving rise to a unified treatment of the quantum phase transitions 
. Fifth, multipartite entanglement is crucial also in condensed matter phenomena and might solve some unresolved 
problems such as high-T superconductivity Q. Sixth, multipartite entanglement is recognized as a unreplaceable or 
efficient resource to perform tasks involving a large number of parties such as network teleportation [8|, quantum 
cryptography (3 , quantum secret sharing remote entangling [Tl|, quantum (tele)cloning [T^], quantum Byzantine 
agreement |l3|. etc. Finally, multipartite entanglement is conjectured to yield a wealth of fascinating and unexplored 
physics [l4j |. Current research in multipartite entan glem ent is pro gre ssing along two directions in parallel. One di- 
rection deals with problems such as how to classify |15|. quantify generate/control/distill 01 an d witness 0] 
multipartite entanglement. The other direction proceeds to advance various applications exploiting the nonclassical 
multiway correlation inherent in multipartite entanglement 0, U ITol ITU IT^ . Il3| . Our work here belongs to the second 
direction mentioned above. Namely, we propose protocols to organize the so-called quantum exam which will be 
specified in the next section. To meet the necessary confidentiality of the exam we use suitable multipartite GHZ 
entangled states as the quantum channel. We consider two scenarios. One scenario is absolutely secure provided 
that the participants share a prior proper multipartite entanglement. The other scenario can be performed directly 
without any nonlocal quantum arrangements in the past but it is only asymptotically secure. Both the scenarios are 
shown to stand against commonly utilized eavesdropping attacks. 
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2. Quantum exam 

Exploiting the superdense coding feature possessed in bipartite entanglement we have recently proposed a quantum 
dialogue scheme (see also |2{j) allowing two legitimate parties to securely carry out their conversation. In this 
work multipartite entanglement will be judiciously exploited to do a more sophisticated task. Suppose that a teacher 

Alice wishes to organize an important exam with her remotely separate students Bob 1, Bob 2, and Bob N. 

Alice gives her problem to all Bobs and, after some predetermined period of time, asks each Bob to return a solution 
independently. Alice's problem should be kept confidential from any outsiders. The solution of a Bob should be 
accessible only to Alice but not to anyone else including the N — 1 remaining Bobs. Such confidentiality constraints 
cannot be maintained even when Alice and Bobs are connected by authentic classical channels because any classical 
communication could be eavesdropped perfectly without a track left behind. However, combined with appropriate 
quantum channels such an exam is accomplishable. We call it quantum exam, i.e. an exam organized in a quantum 
way to guarantee the required secrecy. 
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Let Alice's problem is a binary string 

Q = {dm} (1) 

and the solution of a Bob is another string 

where n = 1, 2, TV labels the Bob while g m , r nm e {0, 1} with m = 1, 2, 3, ... denote a secret bit of Alice and a 
Bob. 

2.1. Absolutely secure protocol 

An exam consists of two stages. In the first stage Alice gives a problem to Bobs and in the second stage she collects 
Bobs' solutions. 

The problem-giving process 

To securely transfer the problem from Alice to Bobs the following steps are to be proceeded. 

al) Alice and Bobs share beforehand a large number of ordered identical (N + l)-partite GHZ states in the form 

l*m> = m am , m ... Nm = ^= (\oo-0) amlm ... Nm + \n...i) amlm N J (3) 

of which qubits with Alice and qubits n m with Bob n. 

a2) For a given m, Alice measures her qubit a m in the basis B z = {|0) , |1)}, then asks Bobs to do so with their 
qubits n m . All the parties obtain the same outcome where jm = (j^ = 1) if they find |0) (|1)). 

a3) Alice publicly broadcasts the value x m — q m © jm (© denotes an addition mod 2). 

a4) Each Bob decodes Alice's secret bit as q m = x m © j^. 

This problem-giving process is absolutely secure because j^, for each m, takes on the value of cither or 1 with 
an equal probability resulting in a truly random string {j^} which Alice uses as a one-time-pad to encode her secret 
problem {q m } simultaneously for all Bobs who also use {j^} to decode Alice's problem. 

The solution-collecting process 

After a predetermined period of time depending on the problem difficulty level Alice collects the solution from 
independent Bobs as follows. 

bl) Alice and Bobs share beforehand a large number of ordered nonidentical (N+ l)-partite GHZ states in the form 

l*m> = l*>a ra l ra ...J Vra =^l*>a ra l ra ... JVra ( 4 ) 

with 

U m = I am ® u(si m ) <g> u(s 2m ) ® ... ® u(s Nm ) (5) 

where I Um is the identity operator acting on qubit a m and 

«(« nm ) = (|0)<l| + |l)<0|)»»«. (6) 

is a unitary operator acting on qubit n m . For each n and m, the value of s„ m chosen at random between and 
1 is known only to Alice but by no means to any other person including Bobs. Qubits a m are with Alice and 
qubits n m with Bob n. 

b2) For a given m, Alice measures her qubit a m in B z with the outcome j* m = {0, 1}, then asks Bobs to do so with 
their qubits n m with the outcome j* m = {0, 1}. 

b3) Each Bob n publicly broadcasts the value y nm = r nm © j* . 
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b4) Alice decodes the solution of Bob n as r nm = y nm © \&o,s nm jl m + f>i,s nm (ja m ® ■*-)] ■ 

In the solution-collecting process the outcomes j* and are not the same anymore in general, but they are 
dynamically correlated as — ^o,s nm ja m + ^i.s,i m (.3a, © -0- This correlation allows only Alice who knows the value 
of {s nm } to decode the solution of a Bob after she obtains her own measurement outcome j% . As is clear, each of the 
N strings {j* }, {if }, {jfj } appears truly random and each such a string is used by a Bob and Alice only one 
time to encode/decode a secret solution {r nm }. The above solution-collecting process is therefore absolutely secure as 
well. 

The essential condition to ensure absolute security of the quantum exam is a prior sharing of the entangled states 
{l^m)} and {1$™)} between the teacher Alice and the students Bobs. It is therefore necessary to propose methods 
for multipartite entanglement sharing. 

The |^I' m )-sharing process 

Alice and Bobs can securely share the states {|>I'„ l )} as follows. 

cl) Alice generates a large enough number of identical states ^m) defined in Eq. 10 2lj. For each such state she 
keeps qubit a m and sends qubits l m , 2 m , N m to Bob 1, Bob 2, Bob N, respectively. Before sending a 
qubit n m Alice authenticates Bob n of that action. 

c2) After receiving a qubit each Bob also authenticates Alice independently. 

c3) Alice selects at random a subset out of the shared |^l/ m )-states and lets Bobs know that subset. For each 

state of the subset Alice measures her qubit randomly in B z or in B x = {|+) , |— )} with |±) = (|0) ± |l))/\/2}. 
Then she asks every Bob to measure their qubits in the same basis as hers. Alice's (Bobs') outcome in B z 
is JaXjni) = {0; 1} corresponding to finding {|0) , |1)} and that in B x is ja,(Jn ) = { + 1- — 1} corresponding to 
finding ||+), |-)}. 

c4) Alice requires each Bob to publicly reveal the outcome of each his measurement and makes an analysis. For 
those measurements in B z she compares j* with : if j* — j* Vn it is all-right, otherwise she realizes a 
possible attack of an outsider Eve in the quantum channel. As for measurements in B x she compares j% with 

Jf = n^Li 3n, '■ ^ 3ai — Jf ^ i s all-right [23|, otherwise there is Eve in the line. If the error rate exceeds a 
predetermined small value Alice tells Bobs to restart the whole process, otherwise they record the order of the 
remaining shared | x P m )-states and can use them for the problem-giving process following the steps from al) to 
a4). 

The |$ m )-sharing process 

The states {1$™)} cab be securely shared between the participants as follows. 

dl) Alice generates a large enough number of identical states {l^m)} |2l|. She then applies on each of the identical 
states a unitary operator U p determined by Eq. to transform them into the |<J> p )-states defined in Eq. Q 
which are nonidentical states [2]|. Afterward, for each , she keeps qubit a p and sends qubits l p , 2 P , N p 
to Bob 1, Bob 2, Bob N, respectively. Before sending a qubit n p Alice authenticates Bob n of that action. 

d2) After receiving a qubit each Bob also authenticates Alice independently. 

d3) Alice selects at random a large enough subset {!$;)} out of the shared |$ p )-states and lets Bobs know that 
subset. For each state of the subset Alice measures her qubit randomly in either B z or B x , then asks Bobs 
to measure their qubits in the same basis as hers. 

d4) Alice requires each Bob to publicly reveal the outcome of each his measurement and makes a proper analysis. 
For those measurements in B z she verifies the equalities j£ t — 5o jSn j* t + Sx tSn © 1). If the equalities hold for 
every n it is all-right, otherwise the quantum channel was attacked. As for measurements in B x she compares 
j* with Jf — Y\.n=i3n, '■ ^ 3a, = Jf ^ i s all-right (2^, otherwise the quantum channel was attacked. If the 
error rate exceeds a predetermined value Alice tells Bobs to restart the whole process, otherwise they record 
the order of the remaining shared |$ p )-states and can use them for the solution-collecting process following the 
steps from bl) to b4). 

Security of the entanglement-sharing process 

To gain useful information about the exam, Eve must attack the quantum channel during the entanglement-sharing 
process. Below are several types of attack that Eve commonly uses. 
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Measure- Res end Attack. In B z Eve measures the qubits emerging from Alice and then resends them on to Bobs. 
After Eve's measurement the entangled state collapses into a product state and her attack is detectable when Alice 
and Bobs use B x for a security check . 

Disturbance Attack. If Alice and Bobs check security only by measurement outcomes in B x , then Eve, though 
cannot gain any information, is able to make the protocol to be denial-of-service. Namely, for each n, on the way 
from Alice to Bob n, Eve applies on qubit n an operator u{v nm ) as defined in Eq. © with v rim randomly taken as 
either or 1, then lets the qubit go on its way. By doing so the disturbed states become truly random and totally 
unknown to everybody, hence no cryptography is possible at all. Though measurements in B x cannot detect this type 
of attack [2(| , those in B z can ■ 

Entangle- Measure Attack. Eve may steal some information by entangling her ancilla (prepared, say, in the state 
\x)e) w ^ n a qubit n (assumed to be in the state \i) ) before the qubit reaches Bob n : \x) E \i) — > a \xi) E \i) n + 
fi \xj) E \i © l) n where \a\ 2 + |/3| 2 = 1 and e (Xi \xJ) e ~ ®- After Bob n measures his qubit Eve does so with her ancilla 
and thus can learn about the Bob's outcome. Yet, with a probability of \/3\ 2 Eve finds \Xi) E m which case she is 
detected if the security check by Alice and Bobs is performed in B z |2£j • 

Intercept- Res end Attack. Eve may create her own entangled states \^') a , v N , {W) a > y jy = U' m \®') a , v N , 
where U' m = I a i © u ( s i m ) ® u ( s 2 m ) ® •■■ ® u ( s 'n ) w hh {s' nm } an arbitrary random string). Then she keeps qubit a' m 
and sends qubit n' m to Bob n. When Alice sends qubits n m to Bobs Eve captures and stores all of them. Subsequently, 
after Alice's and Bobs' measurements, Eve also measures her qubits a' m and the qubits n m she has kept to learn the 
corresponding keys. This attack is detected as well when Alice and Bobs use 2? z -measurement outcomes for their 
security-check |23 |. 

Masquerading Attack. Eve may pretend to be a Bob in the |\E' m )-sharing process to later obtain Alice's problem. 
Likewise, she may pretend to be Alice in the |4>^)-sharing process to later collect Bobs' solutions. Such pretenses are 
excluded because each Bob after receiving a qubit has to inform Alice and Alice before sending a qubit has also to 
inform all Bobs. The classical communication channels Alice and Bobs possess have been assumed highly authentic 
so that any disguisement must be disclosed. 

2.2. Asymptotically secure protocol 

In some circumstances an urgent exam needs to be organized but no prior quantum nonlocal arrangements are 
available at all. We now propose a protocol to directly accomplish such an urgent task. At that aim, Alice has to have 
at hand a large number of states {l^m)} and {|$ m ) = U m \^l m )}. Let M (M') be length of Alice's problem (Bobs' 
solution) and T the time provided for Bobs to solve the problem. 

The direct problem-giving process 

Alice can directly give her problem to Bobs by "running" the following program. 

cl) rn = 0. 

e2) m = m + 1. Alice picks up a state |^ m ) , keeps qubit a m and sends qubits l m , 2 m , iV m to Bob 1, Bob 2, 
Bob N, respectively. Before doing so Alice informs all Bobs via her authentic classical channels. 

e3) Each Bob confirms receipt of a qubit via their authentic classical channels. 

e4) Alice switches between two operating modes: the control mode (CM) with rate c and the message mode (MM) 
with rate 1 — c. Alice lets Bobs know which operating mode she chose. 

e4.1) If CM is chosen, Alice measures qubit a m randomly in B z or B x with an outcome or j% , then lets Bobs 
know her basis choice and, asks them to measure their qubits n m in the chosen basis. After measurements 
each Bob publicly publishes his outcome or j% . Alice analyzes the outcomes: if = j* = jf = 

... = j'jy- or j£ m — n«=i 3n m s he sets m = m— 1 and goes to step e2) to continue, else she tells Bobs to 
reinitialize from the beginning by going to step el). 

e4.2) If MM is chosen, Alice measures qubit a m in B z with an outcome and publicly reveals x m = j* © q m . 
Each Bob measures his qubit also in B z with an outcome j„ , then decodes Alice's secret bit as q m = 
© x m - If rn < M Alice goes to step e2) to continue, else she publicly announces: "My problem has been 
transferred successfully to all of you. Please return your solution after time T" . 

The direct solution-collecting process 

After time T Alice can directly collect Bobs' solutions by "running" another program as follows. 



gl) m = 0. 
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g2) m = m + 1. Alice picks up a |$ m ) , keeps qubit a m and sends qubits l m , 2 m , iV m to Bob 1, Bob 2, Bob 
N, respectively. Before doing so Alice informs all Bobs via her authentic classical channels. 

g3) Each Bob confirms receipt of a qubit via their authentic classical channels. 

g4) Alice switches between two operating modes: the CM with rate c and the MM with rate 1 — c. Alice lets Bobs 
know which operating mode she chose. 

g4.1) If CM is chosen, Alice measures qubit a m randomly in B z or B x with an outcome j* m or j'J , then 
lets Bobs know her basis choice and, asks them to measure their qubits n m in the chosen basis. After 
measurements each Bob publicly publishes his outcome j* m or jn m ■ Alice analyzes the outcomes: if = 

8o,s n 3n + #i,s„ (jn © 1) for every n or = Yln=i 3n sne sets m = m — 1 and goes to step g2) to 
continue, else she tells Bobs to reinitialize from the beginning by going to step gl). 

g4.2) If MM is chosen, Alice measures qubit a m in B z with an outcome j* m and each Bob measures his qubit also 
in B z with an outcome . Each Bob publicly reveals y nm — r nm and Alice decodes Bobs' secret 

bits as r nm = y nm [So, Snm j* m + 6i, s „ m (Ja m ® l )] for n = l ' 2 ' •••> N.J£m< M' Alice goes to step g2) to 
continue, else she publicly announces: "Your solutions have been collected successfully". 

As described above, in the direct problem-giving (solution-collecting) process Alice alternatively gives (collects) 
secret bits and checks Eve's eavesdropping. These direct protocols also stand against the types of attack mentioned 
above. The protocols terminate immediately whenever Eve is detected in a control mode. However, Eve might get a 
partial information before her tampering is disclosed. Such an information leakage can be reduced as much as Alice 
wants by increasing the control mode rate c at the expense of reducing the information transmission rate r = 1 — c. 
For short strings Q and R n (see Eq. Q and Eq. Eve's detection probability may be quite small. But, the longer 
the strings the higher the detection probability. In the long-string limit the detection probability approaches one, i.e. 
Eve is inevitably detected. In this sense, the direct quantum exam protocols are asymptotically secure only. 

3. Conclusion 

We have proposed two protocols for organizing a quantum exam |3Cj basing on a judicious use of appropriate 
multipartite entangled states. The first protocol is absolutely secure iff the participants have successfully shared 
the necessary entanglement in advance. We also provide methods for sharing the multipartite entanglement in the 
presence of a potential eavesdropping outsider. The second protocol can be processed directly without a prior entan- 
glement sharing. This advantage is however compromised by a lower confidentiality level or by a slower information 
transmission rate. Both the protocols have been shown to sustain various kinds of attacks such as measure-resend 
attack, disturbance attack, entangle-measure attack, intercept-resend attack and masquerading attack. Our protocols 
work well in an idealized situation with perfect entanglement sources/measuring devices and in noiseless quantum 
channels which we have assumed for simplicity. We are planning to further develop our protocols to cope with more 
realistic situations. 
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